California AI governance readiness
California AI governance readiness for audits and independent review
California now has a state framework for AI auditors and several AI rules already in force. Each one draws on the same records: which AI systems you run, who owns them, what changed, and what the controls show.
Sentient builds those records so they hold up under independent review. Regulatory status shown as of October 2026.
01
- Audit
- Record
- Review
What changed in 2026
California set rules for who can audit AI
On 9 September 2026, Governor Newsom signed SB 813 and AB 1405. Together they create a state framework for the people and organizations that audit AI systems. Neither law requires companies to obtain an AI audit.
The practical effect is on what counts as a credible review. Customers, insurers, and investors who ask for independent AI review will have a state standard to point to, and auditors working to it will expect complete, current records.
Sentient builds governance into the tools, workflows, and processes teams already use, so controls, approvals, evidence, and review come out of the work itself instead of extra tasks.
What AI governance includesSentient does not audit, certify, or manufacture assurance. It prepares the records that independent reviewers examine.
02
- SB 813
- AB 1405
- N-9-26
SB 813 and AB 1405
The AI auditor framework and its deadlines
Both laws take effect 1 January 2027. Executive Order N-9-26, signed 18 September 2026, moved the agency deadlines earlier.
01
AB 1405: AI auditor registry
Signed 9 September 2026
Creates a registry of AI auditors at the Government Operations Agency, with independence, transparency, and integrity standards. Audit reports must state scope, results, remediation, and limitations.
- Registry by 1 December 2027
- Registration required from 1 January 2029
- Records kept 10 years
02
SB 813: independent verification organizations
Signed 9 September 2026
Lets the agency designate independent verification organizations that audit AI internal controls against identified standards. Taking part is voluntary for developers and deployers.
- Criteria by 1 May 2027
- No audit mandate
- Audits relevant, not conclusive, in harm cases
03
Executive Order N-9-26
Signed 18 September 2026
Asks for recommendations by 16 November 2026 on onsite verifiers at frontier labs, independent verification of safety filings, a kill switch for frontier models, and loss-of-control incident reporting. These are proposals and impose no requirements yet.
- Recommendations due 16 November 2026
- Pending
03
- Privacy
- Employment
- Frontier
California AI rules already in force
Rules that already reach AI systems, and who they cover
Each rule applies to specific businesses or uses. Counsel should confirm which apply to you.
01
CCPA risk assessments
Required before processing that presents significant privacy risk, including automated decision-making for significant decisions. Attestations are due to the agency by 1 April 2028.
CPPA, from 1 January 2026
02
Automated decision-making technology
Pre-use notice, opt-out, and access rights when ADMT makes significant decisions about consumers, such as lending, housing, employment, education, or healthcare.
CPPA, from 1 January 2027
03
CCPA cybersecurity audits
Annual audits by a qualified, objective, independent professional for businesses meeting set thresholds. First certifications are due between 2028 and 2030, by revenue.
CPPA, from 1 April 2028
04
Automated decision systems in employment
Discrimination through an automated decision system can violate FEHA. Employers keep employment records, including automated-decision data, for at least four years.
Civil Rights Council, from 1 October 2025
05
Frontier AI transparency, SB 53
Large frontier developers publish a frontier AI framework and transparency reports. Frontier developers report critical safety incidents to the Office of Emergency Services.
From 1 January 2026
06
Generative AI disclosure
Generative AI developers post training-data documentation. Since 2 August 2026, providers of systems with over one million monthly users offer a detection tool and disclosures.
AB 2013 and SB 942
04
- Inventory
- Owner
- Evidence
Rules and operating records
What the rules ask for, and the record behind it
The rules differ. The records they draw on overlap, which is why one operating record can support several of them.
What the rule asks for
What the operating record shows
What the rule asks for
A risk assessment before high-risk processing, including ADMT for significant decisions.
What the operating record shows
An AI system inventory that flags significant-decision uses, with an assessment owner and review date.
What the rule asks for
Notice, opt-out, and access when ADMT makes significant decisions.
What the operating record shows
The decision logic in use, where human review applies, and a decision history for each request.
What the rule asks for
Employment records, including automated-decision data, kept at least four years.
What the operating record shows
Retention rules tied to each hiring and workforce system, with change history for the tools.
What the rule asks for
Critical safety incident reporting for frontier developers.
What the operating record shows
Incident definitions, an escalation path with named decision makers, and an incident log with times.
What the rule asks for
Audit reports stating scope, results, remediation, and limitations.
What the operating record shows
Defined systems in scope, control evidence, an audit trail, and a remediation record the auditor can test.
Sentient defines these controls and builds the records around them. Your own systems enforce the controls; Sentient is not the enforcement platform.
05
- Scope
- Evidence
- Independence
Independent review readiness
Prepared for review, with the review kept independent
California's auditor rules value independence. A CCPA cybersecurity auditor, for example, cannot be the person who built or runs the program under audit. Preparation and review stay separate.
01
Scope
Systems and dependencies listed in an AI system inventory, with owners and authority boundaries recorded as decision rights.
- Inventory
- Ownership
02
Controls and evidence
Controls that run inside existing workflows and produce evidence as they run, so audit evidence exists before anyone requests it.
- Audit trail
- Change traceability
03
Human review and decisions
Human review points that meet human oversight expectations, with a decision history showing who approved what and why.
- Human oversight
- Decision history
06
- Question
- Answer
Questions, answered
California AI governance questions, answered
Does California require companies to get an AI audit?
Not as a general rule. SB 813 states that it does not require any developer or deployer to engage an independent verification organization or undergo an audit. Separate rules do require specific reviews, such as annual cybersecurity audits for certain businesses under the CCPA regulations.
What do SB 813 and AB 1405 do?
Both were signed on 9 September 2026. AB 1405 creates a state registry of AI auditors with independence and reporting standards, and from 1 January 2029 only registered auditors may conduct covered AI audits in California. SB 813 creates voluntary state designation of independent verification organizations.
AI diligence and assurance readinessWhat is AI audit readiness?
Having the records an independent reviewer needs before the review starts: an AI system inventory, named owners, documented controls, change history, decision history, and evidence that the controls ran. The audit itself is the reviewer's job.
AI governance implementationWhich California AI rules apply to a company now?
It depends on what the company does. Employers using automated decision systems face Civil Rights Council rules, CCPA-covered businesses face risk assessment and ADMT rules, and the largest frontier AI developers face SB 53. Counsel should confirm which apply.
AI governance consultingWe are an early-stage company. Where should we start?
With the foundations: a system inventory, clear ownership, and decision records kept from the start. Those carry into customer due diligence and later independent review without a rebuild.
Sentient Start
07
- Source
- Status
Sources and status
Primary sources for the rules on this page
Regulatory status as of October 2026. Agency criteria under SB 813 and AB 1405 are not yet published.
- Office of the Governor: SB 813 and AB 1405 signed
Press release, 9 September 2026. Confirms both bills were signed.
- Executive Order N-9-26
Signed 18 September 2026. Sets agency deadlines of 1 May 2027 and 1 December 2027, and recommendations due 16 November 2026.
- SB 813, independent verification organizations
Enrolled bill text, California Legislative Information. Adds Government Code section 8898 and following.
- AB 1405, AI auditor registry
Bill text and history, California Legislative Information.
- SB 53, Transparency in Frontier Artificial Intelligence Act
Signed 29 September 2025, effective 1 January 2026. California Legislative Information.
- California Privacy Protection Agency: ADMT, risk assessment, and cybersecurity audit regulations
Approved 22 September 2025, effective 1 January 2026, with phased compliance dates.
- Civil Rights Council: automated decision system regulations
Employment regulations effective 1 October 2025.
Legal note
Sentient is not a law firm and does not give legal opinions. It builds the operating records, controls, and evidence that compliance programs and counsel rely on. For which California rules apply to your business, consult qualified counsel.
08
- Discuss
- Design
- Implement
- Operate
Be ready before they ask
Build the operating structure before the next customer, investor, insurer, partner, or buyer demands proof.
Sentient builds the governance structure companies need to show how AI is owned, controlled, reviewed, evidenced, and operated. Talk to Sentient about what your customers, investors, insurers, partners, or buyers will expect to see.